Login Register

Vida CEM swapping

Post Reply
vtl
Posts: 4936
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 130 times
Been thanked: 686 times

Post by vtl »

RickHaleParker wrote: 21 Sep 2026, 08:46
vtl wrote: 21 Sep 2026, 08:20 Yes, as expected. I could not find how to disable speculation back then in 2020, but these days we have AI... Do a pull request, I'll merge.

You may also try to reduce the amount of samples per range and see how low we can go with the cracking sill being reliable: https://github.com/vtl/volvo-cem-cracke ... r.ino#L654
1. I have not touched git for for 4 - 5 years and I was not very good then. I will try to get it uploaded, then do a pull request.
2. All 5 got to the top in range 100 ( 10 samples ) or range 50 ( 20 samples ) 30 total.
Soo how about shorten ranges and samples to:

Code: Select all

uint32_t ranges[[b]3[/b]]  = { 100, 50, 25 };
 uint32_t samples[[b]3[/b]] = { 10,  20, 50 };

for (i = 0; i < [b]3[/b]; i++) {

    /* run through the range and exit if aborted */
to play it on the safe side?
AI can lead you through git/github process ;) It is not difficult.

I don't have the cracker setup at the moment. Ask AI to come up with the testing methodology for that, it will be able to notice when the precision starts to worsen beyond being practical. This can be another commit in another pull request. Disabling the speculation is good on its own.

Volvisti
Posts: 19
Joined: 05 Sep 2023, 14:04
Year and Model: C30
Location: Aussie
Been thanked: 1 time

Post by Volvisti »

google says "On Volvo P1 platform vehicles (such as the C30, S40, V50, and C70), a 0x02 response during a security access or PIN brute-forcing operation indicates that the Central Electronic Module (CEM) has entered a security time-delay lock.This specific negative response code (NRC) surfaces when third-party tools or custom diagnostic scripts attempt to send incorrect security keys too rapidly while attempting to crack or unlock the module." thats why i am confused, since cracking worked.

vtl
Posts: 4936
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 130 times
Been thanked: 686 times

Post by vtl »

Power cycle the CEM and send the pin again.

Volvisti
Posts: 19
Joined: 05 Sep 2023, 14:04
Year and Model: C30
Location: Aussie
Been thanked: 1 time

Post by Volvisti »

tried that, didnt help, i left the cem 1time 30 seconds, another time 5minutes off after successful pin verified. but as soon as i just restart and send the pin comman, rejected

vtl
Posts: 4936
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 130 times
Been thanked: 686 times

Post by vtl »

Volvisti wrote: 21 Sep 2026, 09:57 tried that, didnt help, i left the cem 1time 30 seconds, another time 5minutes off after successful pin verified. but as soon as i just restart and send the pin comman, rejected
Show us your source code? Can paste on gist.github.com. Also a part of the cracking log, first 30 lines and at the end, where the PIN is printed.

User avatar
RickHaleParker
Posts: 7204
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 979 times

Post by RickHaleParker »

vtl wrote: 21 Sep 2026, 08:53
1. AI can lead you through git/github process ;) It is not difficult.

2. Ask AI to come up with the testing methodology for that, it will be able to notice when the precision starts to worsen beyond being practical.
1. GitHub desktop for Linux has gotten much better over the last 5 years. Its more push a button nowadays. :wink:

2. It would tell when my hardware starts to worsen. I am thinking about the other people with different cracker builds and different CEMs.
Do not want to push it too hard and break it for them.
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )

vtl
Posts: 4936
Joined: 16 Aug 2012, 13:35
Year and Model: 2005 XC70
Location: Boston
Has thanked: 130 times
Been thanked: 686 times

Post by vtl »

RickHaleParker wrote: 21 Sep 2026, 10:31 2. It would tell when my hardware starts to worsen. I am thinking about the other with different cracker builds and different CEMs. Do not want to push it too hard and break it for them.
We have enough evidence that speculation is stepping in our ways. 180 MHz down clock, interrupt-driven one-pass P1 cracking by sirloins to mention a few. Share you code at least, people will test it.

Volvisti
Posts: 19
Joined: 05 Sep 2023, 14:04
Year and Model: C30
Location: Aussie
Been thanked: 1 time

Post by Volvisti »

not needed anymore
Last edited by Volvisti on 21 Sep 2026, 15:18, edited 1 time in total.

Volvisti
Posts: 19
Joined: 05 Sep 2023, 14:04
Year and Model: C30
Location: Aussie
Been thanked: 1 time

Post by Volvisti »

ok, i found it by puting up a loop for the last byte, not 10 but 20 - funny.

User avatar
RickHaleParker
Posts: 7204
Joined: 25 May 2015, 14:30
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 979 times

Post by RickHaleParker »

vtl wrote: 21 Sep 2026, 10:41 We have enough evidence that speculation is stepping in our ways. 180 MHz down clock, interrupt-driven one-pass P1 cracking by sirloins to mention a few. Share you code at least, people will test it.
Code is posted on a branch not pushed to main yet. Let have some people download and test it before pushing it to main and upstream.

The code is here.
Active
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2017 Ford PIU. 3.5l, Twin Turbo, 365 Hp.
............................
Past
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000. ( Killed by a plastic radiator. )
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion ( I moved, the project did not )
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0. ( Transmission dead after sitting for a winter )

Post Reply
  • Similar Topics
    Replies
    Views
    Last post